CVE-2016-8405

Published: 12 January 2017

An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31651010.

From the Ubuntu security team

Peter Pi discovered that the colormap handling for frame buffer devices in the Linux kernel contained an integer overflow. A local attacker could use this to disclose sensitive information (kernel memory).

Notes

Note that while the CVE description sounds like it could be Android
specific, there's a fix in the upstream kernel tree

Priority

Low

CVSS 3 base score: 4.7

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8405
• https://marc.info/?l=linux-kernel&m=148365805203921&w=2
• https://ubuntu.com/security/notices/USN-3361-1
• https://ubuntu.com/security/notices/USN-3381-1
• https://ubuntu.com/security/notices/USN-3381-2
• NVD
• Launchpad
• Debian